deep-app-audit

Deep audit of a Frappe app for security, correctness, and customization defects.

Skill by frappe

IndexedLicense unknown★ 156

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/frappe-deep-app-audit

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Deep audit of a Frappe app for security, correctness, and customization defects. Runs every security scope and every quality rule in a separate agent, verifies each candidate in a fresh context, and compiles one report. User-invoked only - run /deep-app-audit [app path] [options].

Use cases: documents, security, agent-building

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/deep-app-audit

What's inside

Skill name: deep-app-audit
Description: Deep audit of a Frappe app for security, correctness, and customization defects. Runs every security scope and every quality rule in a separate agent, verifies each candidate in a fresh context, and compiles one report. User-invoked only - run /deep-app-audit [app path] [options].
License: unknown
Instructions: 379 lines in SKILL.md · view on GitHub

Before installing

Ships executable scripts
Instructions call the network

Files (200)

SKILL.md
agents.example.json
check.md · prompts/
context.md · prompts/
report.md · prompts/
scan.md · prompts/
verify.md · prompts/
A01-no-monkey-patching.md · quality/A-customization/
A02-override-class-calls-super.md · quality/A-customization/
A03-extend-instead-of-override.md · quality/A-customization/
A04-regional-override-first.md · quality/A-customization/
A05-override-whitelisted-method-contract.md · quality/A-customization/
A06-hook-the-transaction-not-the-ledger.md · quality/A-customization/
A07-reuse-the-existing-doctype.md · quality/A-customization/
A08-custom-fields-in-code.md · quality/A-customization/
A09-fixtures-overwrite-the-site.md · quality/A-customization/
A10-remove-customizations-on-uninstall.md · quality/A-customization/
A11-declare-required-apps.md · quality/A-customization/
A12-declare-versions-and-branches.md · quality/A-customization/
A13-clean-bench-install.md · quality/A-customization/
A14-dotted-paths-must-resolve.md · quality/A-customization/
A15-scheduler-method-path-is-an-api.md · quality/A-customization/
A16-prefix-custom-fieldnames.md · quality/A-customization/
A17-keep-standard-field-constraints.md · quality/A-customization/
A18-check-every-writer.md · quality/A-customization/
A19-bound-the-custom-field-count.md · quality/A-customization/
A20-server-side-rules-not-in-client-scripts.md · quality/A-customization/
A22-app-logic-not-in-server-scripts.md · quality/A-customization/
A24-hooks-py-is-static-data.md · quality/A-customization/
A25-handler-signature-matches-call-site.md · quality/A-customization/
A26-hook-return-value-contract.md · quality/A-customization/
A27-last-wins-hooks-must-yield.md · quality/A-customization/
A28-permission-hooks-only-narrow.md · quality/A-customization/
A29-virtual-doctype-contract.md · quality/A-customization/
A30-no-code-for-a-custom-doctype.md · quality/A-customization/
A31-default-print-format-property-setter.md · quality/A-customization/
A32-templates-read-data.md · quality/A-customization/
A33-protect-setup-from-company-deletion.md · quality/A-customization/
A34-support-accounting-dimensions.md · quality/A-customization/
A35-ignore-links-on-delete-is-for-logs.md · quality/A-customization/
A38-frappe-call-targets-resolve.md · quality/A-customization/
A39-install-hooks-return-nothing.md · quality/A-customization/
A40-ship-desk-artefacts-as-files.md · quality/A-customization/
A41-no-direct-ledger-writes.md · quality/A-customization/
B01-no-transaction-control-in-lifecycle.md · quality/B-correctness/
B02-own-the-rollback-you-catch.md · quality/B-correctness/
B03-ddl-ends-the-transaction.md · quality/B-correctness/
B04-enqueue-after-commit.md · quality/B-correctness/
B05-check-then-insert-is-a-race.md · quality/B-correctness/
B06-lock-the-rows-you-change.md · quality/B-correctness/
B07-fixed-lock-order.md · quality/B-correctness/
B08-idempotent-endpoint-and-job.md · quality/B-correctness/
B09-computed-field-is-a-function-of-input.md · quality/B-correctness/
B10-rebuild-a-child-table.md · quality/B-correctness/
B11-patch-must-be-rerunnable.md · quality/B-correctness/
B12-reload-doctype-before-a-patch-reads-it.md · quality/B-correctness/
B13-schema-change-needs-a-data-patch.md · quality/B-correctness/
B16-treat-every-read-as-possibly-empty.md · quality/B-correctness/
B17-coerce-at-the-boundary.md · quality/B-correctness/
B18-compare-money-at-field-precision.md · quality/B-correctness/
…and 140 more

The license isn't open source, so the instructions aren't shown here. Read SKILL.md on GitHub

Signals

Stars: 156
Forks: 54
Open issues: 6
Last commit (this folder): Sep 30, 2026 (28 days ago)

From GitHub (fetched Oct 24, 2026).

Details

License: License unknown
Repository: github.com/frappe/skills
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from frappe

Cite this page

deep-app-audit skill. Agent Mart. https://agentmart.dev/skills/frappe-deep-app-audit (last updated 2026-10-24)